Systems and methods for cloud migration readiness

ABSTRACT

A method comprising discovering workload attributes and identify dependencies, receiving utilization performance measurements including memory utilization measurements of at least a subset of workloads, grouping workloads based on the workload attributes, the dependencies, and the utilization performance measurements into affinity groups, determining at least one representative synthetic workload for each affinity group, each representative synthetic workload including a time slice of a predetermined period of time when there are maximum performance values for any number of utilization performance measurements among virtual machines of that particular affinity group, determining at least one cloud service provider (CSP)&#39;s cloud services based on performance of the representative synthetic workloads, and generating a report for at least one of the representative synthetic workloads, the report identifying the at least one of the representative synthetic workloads and the at least one CSP&#39;s cloud services including cloud workload cost.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims benefit of U.S. Provisional PatentApplication Ser. No. 62/806,696, filed Feb. 15, 2019, and entitled“Systems and Methods for Cloud Migration Readiness,” which isincorporated by reference herein.

FIELD OF THE INVENTION(S)

Embodiments of the present invention(s) generally relate to cloudmigration readiness for enterprise systems and, in particular, assessingand reporting challenges associated with transitioning and running allor part of enterprise systems to cloud systems.

BACKGROUND

Complexity of enterprise networks has increased to a point where eveninformation technology (IT) administrators may not have a clear pictureof the network utilization of the enterprise network. Enterprisenetworks are increasingly moving towards a combination of on-premise andcloud-based infrastructure or making the ability to determine computingand storage resources associated with the business-related applicationmore difficult.

To migrate some or all parts of an enterprise network onto a cloud-basedinfrastructure usually requires IT administrators to rewrite orcustomize the code for enterprise network applications such as emailservice, web service, database, customer relationship management (CRM),data file, virtual desktop infrastructure (VDI), enterprise resourceplanning (ERP) to resources offered by a cloud provider. Such approachescan turn into unproductive and costly endeavors due to time-consumingpost re-configurations, failure to achieve the original workloadperformance, or unnecessary overprovisioning of resources.

In other instances, an enterprise may take the “lift and shift”approach, in which the enterprise makes minimal or zero changes to thecode for enterprise network applications. In such instances, the ITadministrator may lift the storage requirements of the on-premisesinfrastructure and shift or replicate the storage requirements in thecloud-based infrastructure. This may result in an over-estimation ofrequired cloud resources and would run contrary to an overall goal of anenterprise of profitability. Every corporation must strike a balancebetween the cost of additional storage versus performance, reliability,and redundancy benefits of the additional storage resources.

Another approach is to choose the right on-premise configurations beforemigration. Although this approach is an improvement over replicating theexisting on-premise configuration, this approach does not lead directlyto a right-sized cloud configuration. The CSPs use high scalable andheavily customized hypervisors. CPUs, memory, and IOPs performance willvary significantly between on-premise and CSPs hypervisors. The outcomeof current approaches results in migration projects that take longer andcost more than expected and, in many cases, leads to costly failures.

SUMMARY

An example system comprising at least one process and memory includingexecutable instructions that are executable by the at least oneprocessor to: discover workload attributes and identify dependenciesamong compute, network, and storage elements of an enterprise system,the enterprise system including any number of networks, applications onservers, and storage devices which are on-premise, receive utilizationperformance measurements including memory utilization measurements of atleast a subset of workloads, each workload including the workloadattributes and identified dependencies, group workloads based on theworkload attributes, the dependencies, and the utilization performancemeasurements into affinity groups, determine at least one representativesynthetic workload for each affinity group, each representativesynthetic workload including a time slice of a predetermined period oftime when there are maximum performance values for any number ofutilization performance measurements among virtual machines of thatparticular affinity group, determine at least one cloud service provider(CSP)'s cloud services based on performance of the representativesynthetic workloads, and generate a report for at least one of therepresentative synthetic workloads, the report identifying the at leastone of the representative synthetic workloads and the at least one CSP'scloud services including cloud workload cost, the cloud workload costbeing based on a periodic cost associated with executing the at leastone of the representative synthetic workload on the at least one CSP'scloud services.

In various embodiments, the utilization performance measurements includeCPU utilization measurements. In some embodiments, the group workloadsbased on the workload attributes, the dependencies, and the utilizationperformance measurements into the affinity groups comprising utilizingk-means clustering to partition at least the utilization performancemeasurements into a number of sets so as to minimize a within-clustersum of squares. In some embodiments, the group workloads based on theworkload attributes, the dependencies, and the utilization performancemeasurements into the affinity groups comprising utilizing k-meansclustering to partition at least the utilization performancemeasurements and the CPU utilization measurements into a number of setsso as to minimize a within-cluster sum of squares. In one embodiment,the discover workload attributes and identify dependencies amongcompute, network, and storage elements of an enterprise system includesreceiving on-premise network data from hardware probes within theenterprise system and determining source and destination of theon-premise network data. In various embodiments, the workloadcharacteristics includes attributes of the entity associated with theworkload. In some embodiments, the wherein the executable instructionsthat are executable by the at least one processor to further: determinecloud virtual machines instance needs for each of the representativesynthetic workloads, identify cloud storage disk types for each of therepresentative synthetic workloads based on the storage devicesassociated with the respective representative synthetic workload, foreach representative synthetic workload, determine periodic costassociated with the cloud virtual machine instances and the cloudstorage disk types, wherein the cloud workload cost is based, at leastin part, on the periodic cost. In one embodiment, the one or more of therepresentative synthetic workloads is performed in the at least oneCSP's cloud services to assist in determining cloud virtual machineinstance needs. In various embodiments, the k-means clustering includesgiven a set of utilization metrics measurements (x₁, x₂, . . . , x_(n)),where each utilization metrics measurement is a d-dimensional realvector, utilizing k-means clustering to partition n utilization metricsmeasurement into k(≤n) sets S={S₁, S₂, . . . , S_(k)} so as to minimizea within-cluster sum of squares (WCSS).

An example computer readable medium including instructions, theinstructions being executable by a processor to perform a method, themethod comprising: discovering workload attributes and identifydependencies among compute, network, and storage elements of anenterprise system, the enterprise system including any number ofnetworks, applications on servers, and storage devices which areon-premise, receiving utilization performance measurements includingmemory utilization measurements of at least a subset of workloads, eachworkload including the workload attributes and identified dependencies,grouping workloads based on the workload attributes, the dependencies,and the utilization performance measurements into affinity groups,determining at least one representative synthetic workload for eachaffinity group, each representative synthetic workload including a timeslice of a predetermined period of time when there are maximumperformance values for any number of utilization performancemeasurements among virtual machines of that particular affinity group,determining at least one cloud service provider (CSP)'s cloud servicesbased on performance of the representative synthetic workloads, andgenerating a report for at least one of the representative syntheticworkloads, the report identifying the at least one of the representativesynthetic workloads and the at least one CSP's cloud services includingcloud workload cost, the cloud workload cost being based on a periodiccost associated with executing the at least one of the representativesynthetic workload on the at least one CSP's cloud services.

A method comprising: discovering workload attributes and identifydependencies among compute, network, and storage elements of anenterprise system, the enterprise system including any number ofnetworks, applications on servers, and storage devices which areon-premise, receiving utilization performance measurements includingmemory utilization measurements of at least a subset of workloads, eachworkload including the workload attributes and identified dependencies,grouping workloads based on the workload attributes, the dependencies,and the utilization performance measurements into affinity groups,determining at least one representative synthetic workload for eachaffinity group, each representative synthetic workload including a timeslice of a predetermined period of time when there are maximumperformance values for any number of utilization performancemeasurements among virtual machines of that particular affinity group,determining at least one cloud service provider (CSP)'s cloud servicesbased on performance of the representative synthetic workloads, andgenerating a report for at least one of the representative syntheticworkloads, the report identifying the at least one of the representativesynthetic workloads and the at least one CSP's cloud services includingcloud workload cost, the cloud workload cost being based on a periodiccost associated with executing the at least one of the representativesynthetic workload on the at least one CSP's cloud services.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts a block diagram of a cloud migration readiness (CMR)service system which discovers, profiles, and performs playback formigration of one or more entities of the enterprise network onto a cloudservice provider (CSP).

FIG. 2 depicts a block diagram of an example CMR service systemaccording to some embodiments.

FIG. 3 depicts a flowchart of a cloud migration process of an enterprisesystem according to some embodiments.

FIG. 4 depicts in further detail the discovery phase of the cloudmigration process according to some embodiments.

FIG. 5 depicts in further detail of an application discovery step of thediscovery phase according to some embodiments.

FIG. 6 depicts in further detail of a flow source discovery of thediscovery phase according to some embodiments.

FIG. 7A is a chart depicting traffic dependency of internal and externalnetwork traffic according to some embodiments.

FIG. 7B is a diagram depicting the traffic dependency of internal andexternal network traffic according to some embodiments.

FIG. 8 depicts an example output of virtual machine and external entitytraffic according to some embodiments.

FIG. 9 is a diagram depicting an example application, external sources,and the amount of network traffic between the two according to someembodiments.

FIG. 10A depicts three examples of “what if” workload movements scenarioaccording to some embodiments.

FIG. 10B is a chart depicting the bandwidth and cost associated witheach of the “what if” workload movement scenarios of FIG. 10A.

FIG. 11A depicts an initial communication map between internal andexternal virtual machines according to some embodiments.

FIG. 11B depicts a second communication map between internal andexternal virtual machines according to some embodiments.

FIG. 11C depicts a third communication map between internal and externalvirtual machines according to some embodiments.

FIG. 12A depicts an example of an on-premises application external andinternal dependencies before migration according to some embodiments.

FIG. 12B depicts an example of an application's external and internaldependencies after migration according to some embodiments.

FIG. 13 depicts in further detail of the profiling phase of the cloudmigration process according to some embodiments.

FIG. 14 depicts affinity groups and representative synthetic workloadsof the enterprise network according to some embodiments.

FIG. 15 is a table comprising a temporal data capturing utilizationlevels of an example workload according to some embodiments.

FIG. 16 depicts graphical charts of network traffic metrics of twoexample representative synthetic workloads according to someembodiments.

FIG. 17 is a chart depicting cloud configuration and the cost of exampleapplications of the enterprise network according to some embodiments.

FIG. 18 depicts in further detail of the playback phase of the cloudmigration process according to some embodiments.

FIG. 19 depicts an example output of an estimated monthly cloud cost fortwo cloud service providers according to some embodiments.

FIG. 20 depicts an example output of the CMR playback phase according tosome embodiments.

FIG. 21 depicts in further detail of the monitor phase of the cloudmigration process according to some embodiments.

FIG. 22 depicts a block diagram illustrating entities of an examplemachine according to some embodiments.

DETAILED DESCRIPTION

Various embodiments leverage performance analytics, workload utilizationprofiling, and cloud simulation to determine which workloads of theenterprise network can be migrated to a cloud infrastructure as aservice (IasS) and their associated cost. As a result, these systems mayprovide insight into the performance and suitability of applications ofthe enterprise network in different cloud service providers (CSP)s. Forexample, systems discussed herein may reduce the risk of large-scalemigrations of workloads or applications to a public and/or private cloudbefore migrating the actual workloads to the cloud.

The “end to end” migration process to an Infrastructure as a Service(IaaS) cloud is a challenging undertaking consisting of many criticalphases and spanning IT infrastructure and application organizations.“Lift and Shift” or “Re-hosting” migrations to the cloud are inherentlyrisky due to many unknown answers to fundamental yet, criticalquestions. In “lift and shift” migrations, the enterprise may utilizeapplications in the cloud that are effectively a clone of the existingdata center implementation. In the “re-hosting” migration, theapplication may be similar to the existing data center implementation,but individual services may be replaced with cloud-native services. Insome embodiments, there may be a combination of the two where someapplications are a clone of the existing data center implementationwhile others are replaced with cloud-native services.

A common approach to cloud migration is to replicate the existingon-premise configuration in the cloud. Such approaches can turn intounproductive and costly endeavors due to time-consuming postre-configurations, failure to achieve the original workload performance,or unnecessary overprovisioning of resources. In many cases, the outcomemay be repatriation back to the on-premise data center.

Another approach is to right-size the on-premise configurations beforemigration. Although this approach is an improvement over replicating theexisting on-premise configuration, it still does not lead directly to aright-sized cloud configuration. The CSPs use high scalable and heavilycustomized hypervisors. CPUs, memory, and IOPs performance will varysignificantly between on-premise and CSPs hypervisors.

In the absence of workload simulation, workload performance can only beverified by moving the actual application to the cloud and there is noguarantee that the CSP will support the resource demands of theworkloads and deliver acceptable performance.

Even if cloud configurations adjustments are made to the originalworkloads after the migration, the operating cost may be significantlyhigher than expected which could lead to repatriation due to anunsustainable and unjustifiable investment.

The outcome of current approaches results in projects that take longerand cost more than expected and, in many cases, leading to very costlyfailures.

Some embodiments described herein include a unique consultativeiterative approach to the discovery and understanding of the workload'sor application's dependencies. Some embodiments blend a consultativeapproach that leverages an agile data discovery, data manipulation, andanalysis implemented by experienced data scientists together withautomation. In one example, the approach may be designed to handle theinitial surge of raw and unstructured data collected during the firstiteration. During the following iterations, focus may be gradually tunedto the priorities and data characteristics revealed during eachiteration. By the third iteration, the dependency mapping may be stableand available to create the “move groups” and “move events.” After thefinal iteration, customers may be offered the option to access a SaaSplatform to continue the dependency mapping data manipulation.

In one example, a system may identify and determine workloadcharacteristics, baseline on-premises service level agreements (SLAs),and dependencies between compute, networking, and storage elements ofthe enterprise network. The system may then identify workloads of theenterprise network and categorize them into affinity groups which areused to create synthetic workloads. A synthetic workload on CSP profilesmay be used to simulate the synthetic workload on different CSPs toestimate the performance and cost of migrating the workload ontodifferent CSPs. In some embodiments, after the customer chooses aparticular CSP, the system may monitor actual workloads after the cloudmigration to identify unforeseen performance or capacity issues.

A cloud migration readiness (CMR) service system may be used to give ITadministrators an awareness of the dependencies of the various elementsof the enterprise system. For example, the CMR service system mayutilize an application discovery system and flow source discovery systemto analyze the performance of applications of the enterprise network andprofile workload utilization to determine workloads that may be migratedto a CSP.

The application discovery system may give IT administrators andoperators awareness of applications and related network infrastructure.The system may obtain real-time views of the infrastructure that isrelevant to the network and usage of the network. In addition, theapplication discovery system may determine entities of theinfrastructure where important applications are located, monitorapplication behavior, and assess/monitor their effect on infrastructureresources. The CMR service system may utilize the output of theapplication discovery system to provide real-time visibility into theperformance, health, and utilization of applications across physical,virtual, and cloud computing environments.

Flow source discovery system may collect traffic data in the form ofdata packets from a wide variety of routers and switches manufactured bydifferent companies. The results of the data flow source discoveryprocess may be used to detect network anomalies, control bandwidthutilization, optimize application performance, and/or troubleshootproblems. Examples of network anomalies include DDoS attacks, SPAM,BotNets, abnormal downloads/uploads, or the like. The data flow sourcediscovery system may control bandwidth utilization by monitoring datatraffic metrics, and providing alarms or alerts for various data trafficmetrics such as read response time, fabric transmission errors, linkerrors, link transmission errors, network usage rate, port utilization,etc. The CMR service system may utilize the output of the flow sourcediscovery system to determine a traffic dependency of internal andexternal entities of the enterprise network.

FIG. 1 depicts a block diagram of an enterprise system 100, including aCMR service system 185, capable of simulating a synthetic workload ondifferent CSPs to estimate the performance and cost of migrating one ormore applications of the enterprise network onto different CSPs. In thisexample, the enterprise system 100 comprises an enterprise network 105,a network traffic analyzing software platform 150, and an infrastructureperformance management (IPM) appliance 160. The enterprise network 105includes a storage device 110, a server/host 120, a switch fabric 130,and traffic access points (TAP) 140. The IPM appliance 160 includes aflow source discovery system 170, an application discovery system 180,and the CMR service 185.

Storage devices 110 of the enterprise system 100 includes any number ofstorage devices that store data. In one embodiment, the storage devices110 include one or more disk arrays. For example, the storage devices110 may include a storage array network (SAN). In various embodiments,the storage device is cloud storage.

Server/host 120 may be any digital device with an instance of anoperating system. For example, any number of hosts 120 may be a physicalcomputer managed by Microsoft Windows. Hosts 120 may include instancesof UNIX, Red Hat, Linux and/or others. The hosts 120 may include one ormore virtual machines.

The switch fabric 130 may provide communication between any two entitiesof the enterprise system 100, such as the storage devices 110, theserver/host 120, the TAP 140, and the network traffic analyzing softwareplatform 150. The switch fabric 130 may use packet switching to receive,process, and forward data from a source device to a destination device.The switch fabric 130 may refer to switches (e.g., flow sources) thatare used to direct and assist in the communication of information of theenterprise network 105.

The TAP 140 may provide connectivity to links between storage ports ofthe storage device 110 and switches of the switch fabric 130. In variousembodiments, the TAP 140 may provide connectivity on both sides offabric-based storage virtualizers. In one example, the TAP 140 is anoptical splitter that provides a copy of data passing through a fiberoptic channel of the enterprise network 105 without affecting theintegrity of the data. In this example, the fiber optic channel mayconnect storage devices (of a SAN) with servers of the enterprisenetwork. The copy of the data may be used for real-time performancemonitoring of traffic traveling through the fiber optic channel and/orto assist with application discovery.

The network traffic analyzing software platform 150 may discover flowsources on the enterprise network 105. The network traffic analyzingsoftware platform 150 may be any third-party platform that is integratedinto routers or switches by their respective manufacturers to aid usersin monitoring performance of traffic data entering and exiting thatspecific switching hardware. An example of a network traffic analyzingsoftware platform 150 is Netflow. Although the network traffic analyzingsoftware platform 150 of a particular provider may perform some flowsource detection, the network traffic analyzing software platform 150may provide only limited information about the flow sources (e.g.,limited metrics) and may not include other switches of othermanufacturers (i.e., that is not a part of that particular providersnetwork traffic analyzing software platform 150).

The application discovery system 180 may receive from the flow sourcediscovery system 170 possible roles of network endpoints. These possiblenetwork endpoint roles may be used by the application discovery system180 to discover applications through heuristic analysis. For example,data received from a known flow source (e.g., discovered by the flowsource discovery system 170) may be assessed to determine whatapplications provided and/or received information from the data. Datareceived from a known flow source may be, in one example, intercepted orcopied from a TAP that interfaces with communication paths of theenterprise network 105. Based on that information as well as the type ofcommunication, the frequency of communication, and/or the like, theapplication discovery system 180 or the flow source discovery system 170may label a network endpoint with one or more roles performed within theenterprise network 105. The output of the application discovery system180 may be a list of applications on the enterprise network, andentities of the enterprise system associated with each of theapplications.

The CMR service 185 may utilize data from the network traffic analyzingsoftware platform 150, the flow source discovery system 170, and theapplication discovery system 180 to identify applications and determinetraffic dependency of internal and external entities of the enterprisenetwork. The CMR service 185 may receive the identified application andtraffic dependencies of internal and external entities of the enterprisenetwork and categorize workloads of the enterprise network into multipleaffinity groups. The CMR service 185 may determine representativesynthetic workload for the multiple affinity groups. The CMR service 185may use simulated cloud service providers and the representativesynthetic workload to simulate the representative synthetic workload ondifferent CSPs to estimate the performance and cost of migrating theworkload onto different CSPs. During each phase of the cloud migrationreadiness process, the CMR service 185 may provide a user interfaceduring each phase of the cloud migration readiness process. The userinterface may provide a chart depicting traffic dependencies of internaland external network traffic, such as an example chart of FIG. 7A. Thecloud migration readiness process may include four phases, a discoveryphase, a profiling phase, a playback phase, and a monitor phase. Moredetails of these four phases of the cloud migration readiness processwill be discussed in FIG. 3.

The output of the CMR service 185 may be an estimated performance andcost of moving one or more applications or portions of one or moreapplications. A customer may utilize this information to determine theapplications, or portions of the application to migrate to a CSP. Afterthe migration is completed, the CMR service 185 may monitor theworkloads associated with the application to identify unforeseenperformance or capacity issues.

It will be appreciated that some embodiments may provide a variety ofdifferent services beyond cloud migration readiness. For example, theCMR service 185 may provide infrastructure performance assessment. Inthis example, the CMR service 185 may enable mitigation of the risk ofmajor infrastructure initiatives and optimize infrastructure performancethrough application discovery, identification of workgroups,categorization of workgroups into affinity groups, creation ofrepresentative synthetic workloads, and simulation of the representativesynthetic workloads into different representative infrastructureinitiatives. This process may provide definitive insight into currentand planned workload and performance. Further, this process may beutilized in customer planning technology refreshes, migrations,consolidations, or new deployments.

Further, the CMR service 185 may provide storage performance validationin some embodiments. For example, the CMR service 185 may provideaccurate workload modeling and guidance for storage infrastructurevalidation. Through application discovery, identification of workgroups,categorization of workgroups into affinity groups, creation ofrepresentative synthetic workloads, and simulation of the representativesynthetic workloads into different representative infrastructureinitiatives, the CMR service 185 may enable that accurate applicationworkload validation models may be built to validate storage. Thisprocess may be used to enable evaluation and testing of storageinfrastructure.

FIG. 2 depicts a block diagram of an example CMR service system 185according to some embodiments. The CMR service system 185 includes acommunication module 202, a migration module 204, an input module 206,an application discovery interface module 208, a workload module 210, anaffinity group module 212, a flow source discovery interface module 214,a traffic analyzing module 216, a scheduling module 218, a workloaddatastore 220, a cloud service provider profile datastore 222, areporting module 224, and a flow source datastore 226.

The communication module 202 may send and receive requests or databetween any of the CMR service system 185, the network traffic analyzingsoftware platform 150, the application discovery system 180, and theflow source discovery system 170. The communication module 202 mayreceive a request from the IT administrator of the enterprise network105 to commence the cloud migration readiness process. In someembodiments, the communication module 202 may send a request to theapplication discovery system 180 for data regarding applications of theenterprise network 105 discovered by the application discovery system180.

The communication module 202 may receive from the network trafficanalyzing software platform 150 any number of data packets andoptionally send any number of data packets to the input datastore 218.The communication module 202 may send a request to the flow sourcediscovery system 170 for discovered flow source(s) and their associatedattributes (e.g., in a table, chart, graph, or the like). In someembodiments, the communication module 202 may receive a request from thereporting module 224 to provide, in the form of charts or graphs,traffic dependencies of internal and external network traffic.

The migration module 204 may manage the cloud migration readinessprocess and/or may commence the cloud migration readiness process. Themigration module 204 may commence the cloud migration readiness processwhen the migration module 204 determines that any number of triggerconditions is satisfied. For example, a trigger condition may includethe scheduling module 218 determining that a current time equals ascheduled cloud migration readiness process start time. In someembodiments, one of the trigger conditions includes receiving from theinput module 206 a request to commence the cloud migration readinessprocess. Upon the reception of the request to commence the cloudmigration readiness process from the scheduling module 218 or the inputmodule 206, the migration module 204 may commence the cloud migrationreadiness process.

The migration module 204 may suspend the flow source discovery processwhen the migration module 204 determines that a trigger condition issatisfied. For example, a trigger condition may include the schedulingmodule 218 determining that a current time equals the scheduled cloudmigration readiness process end time. In this example, a schedulingmodule 218 may determine or be configured to identify a time whenresources are being used by the enterprise (e.g., peak times or businesshours) which may satisfy the trigger continue to suspend the flow sourcediscovery process (e.g., thereby conserving resources for use by theenterprise. Similarly, there may be a time during the evenings oroff-peak times identified by the scheduling module 218 which may triggera transition from suspend to re-engaging the flow source discoveryprocess. In some embodiments, the migration module 204 may flag orbookmark one or more points (e.g., at suspension points or any point) inthe flow source discovery process such that when the process isre-engaged after being suspended, the flow source discovery process maybegin at or near the point in the flow source discovery process when theprocess was suspended.

In some embodiments, one of the trigger conditions includes receivingfrom the input module 206 a request to suspend the cloud migrationreadiness process. Upon the reception of the request to commence theflow source discovery from the scheduling module 218 or the input module206, the migration module 204 may suspend the cloud migration readinessprocess.

In some embodiments, the migration module 204 manages a commencement orsuspension of any one of the multiple phases of the cloud migrationreadiness process. For example, the migration module 204 may commencethe discovery phase of the cloud migration readiness process when themigration module 204 determines that any number of trigger conditions issatisfied. In one embodiment, the discovery phase of the cloud migrationreadiness process lasts two to four weeks. In various embodiments, theprofiling phase lasts two weeks, the playback phase lasts two weeks, andthe monitoring phase lasts four weeks.

The input module 206 may initiate the cloud migration readiness processor a phase of the cloud migration readiness process (e.g., based onreceiving a request from the IT administrator of the enterprise network105). In some embodiments, the input module 206 may receive a request tostart an application discovery process. In various embodiments, theinput module 206 may receive a request to start a flow source discoveryprocess. In some embodiments, the input module 206 receives a scheduleof the cloud migration readiness process. For example, the input module206 may receive a start date and time of the cloud migration readinessprocess start time. In some embodiments, the input module 206 mayreceive, from the IT administrator of the enterprise network 105, knownworkloads.

The application discovery interface module 208 interfaces with theapplication discovery system 180. In some embodiments, the applicationdiscovery interface module 208 may send to the output of the applicationdiscovery process to the input module 206. The output of the applicationdiscovery process may include a list of application entries found in theenterprise network 105. Each application entry may include attributes orcharacteristics (e.g., metrics) of the discovered application such as asuggested name of the discovered application as well as attributesassociated with the entities which make up the discovered application.The application discovery process will be discussed further in FIG. 5.

During the discovery phase of the cloud migration readiness process, theworkload module 210 may identify multiple workloads of the enterprisenetwork 105. In some embodiments, a workload represents the amount ofwork or processing accomplished by an entity of the enterprise network105. Entities of the enterprise network 105 may include applications,compute devices, network elements, and storage elements. In someembodiments, entities of the enterprise network include virtualmachines.

In various embodiments, a workload may comprise multiple workloads. Forexample, the workload represents the amount of work or processingaccomplished by an application of the enterprise network 105. Thereby,one workload representing the email service application of theenterprise network comprises multiple virtual machine workloads andserver workloads, which function as part of the email serviceapplication.

In some embodiments, during the discovery phase of the cloud migrationreadiness process, the workload module 210 may determine characteristicsof the workload. Characteristics of the workload may include attributesof the entity associated with the workload. For example, a workload of avirtual machine may include attributes of the virtual machine such asapplications of the enterprise network 105 associated with the virtualmachine and utilization such as maximum read speed, maximum write speed,central processing unit (CPU) MHz, memory utilization percentage,storage demand, and input/output operations per second (IOPS). Forexample, a workload of a storage device may include attributes of thestorage device such as read and write latency.

In some embodiments, the workload module 210 may send a list ofworkloads identified by the workload module 210 to the affinity groupmodule 212. The affinity group module 212 may receive the list ofworkloads and categorize or group some or all of the received workloadsinto one or more affinity groups. In some embodiments, each workload iscategorized into one affinity group. The affinity group module 212 maygroup any number of workloads into synthetic workloads based, at leastin part, on resource utilization (e.g., CPU utilization, memoryutilization, storage utilization and/or the like).

The workload module 210 may determine workload interdependencies (e.g.,how workloads depend on one another). Workload interdependencies help todetermine the sequence of workloads, how services are migrated to thecloud, and what workloads and services should stay on-premise.

The affinity group module 212 may categorize workloads identified by theworkload module 210 into affinity groups. As discussed herein, affinitygroups (e.g., representative synthetic workloads) may consist ofworkloads with similar resource utilization levels and temporal ortime-based characteristics. For example, workloads with similar readspeed and write speeds may be grouped together into the same affinitygroup. In one example, workloads that have a CPU usage of greater than90% during a particular time frame each day may be placed in the sameaffinity groups. In some embodiments, a workload may belong to more thanone affinity group. In other embodiments, each workload may only belongto one affinity group.

In one method, the CMR service system 185 may utilize a machine learningalgorithm to categorize or group workloads into affinity groups. In someembodiments, the workload module may apply a k-means clusteringalgorithm to the multiple workloads identified by the workload module210. The k-means clustering algorithm may have a feature set representedby average, a percentile of maximum values of utilization metrics. Insome embodiments, utilization metrics include CPU utilization, memoryutilization, input/out (IO) read utilization, IO write utilization, IOnumber of reads, IO number of writes, network receive rate, and networktransmit rate.

In another method, the affinity group module 212 groups workloads bytheir maximum or percentile utilization metric fitness into availablecloud instances for a specific CSP. This method may be utilized when aparticular CSP to use has already been determined.

Once the affinity group module 212 determines the workloads that belongto each affinity group, the affinity group module may determine therepresentative synthetic workload for each affinity group. Therepresentative synthetic workload for each affinity group may be a sumof the multiple workloads which make up the affinity group. In variousembodiments, the representative synthetic workload for each affinitygroup may be a weighted sum of the multiple workloads which make up theaffinity group, with each of the multiple workloads given a weight basedon attributes or characteristics of the workload. In some embodiments,the affinity group module may send a request to the workload datastore220 to store the representative synthetic workload associated with eachaffinity group.

The affinity group module 212 may generate a table or chart whichcomprises temporal data capturing utilization level for some or all ofthe utilization metrics. An example of this may be seen in FIG. 15.Table 1500 of FIG. 15 contains temporal data capturing utilizationlevels of two example workloads of the enterprise network 105. Thecolumns of the example table 1500 are associated pairs of date/time ofdata and the name of the workload that is being monitored by theinfrastructure performance management appliance 160 for a particularutilization metric. The number of column pairs is equal to the number ofworkloads being monitored by the workload module 212. For example,column 1510 provides a timestamp for measuring the particularutilization metric, while column 1520 provides the measurement for theparticular utilization metric associated with the timestamp in the samerow.

The flow source discovery interface module 214 interfaces with the flowsource discovery system 170. In some embodiments, the flow sourcediscovery interface module 214 may send the output of the flow sourcediscovery process to the input module 206. The output of the flow sourcediscovery process may include a list of flow source entries. The list offlow source entries may include attributes associated with discoveredflow sources. Attributes may include the type of flow source, total bytecount, incoming/outgoing byte count, incoming/outgoing bit rate, totalpacket rate, and/or incoming/outgoing endpoint count. In someembodiments, attributes associated with flow source entries may includeapplications associated with the flow source. The flow source discoveryprocess will be discussed further in FIG. 6. In some embodiments, theflow source discovery interface module 214 interfaces with the networktraffic analyzing software platform 150. In some embodiments, the flowsource discovery interface module 214 may send a request to the flowsource datastore 226 to store the flow source entries.

The traffic analyzing module 216 analyzes network traffic received fromthe flow source discovery system 170. In some embodiments, the trafficanalyzing module 216 receives network traffic from the network trafficanalyzing software platform 150. The traffic analyzing module 216 mayanalyze internet protocol (IP) communications between entities of theenterprise network 105 as well as IP communications between entities ofthe enterprise network and entities that are external to the enterprisenetwork 105. The traffic analyzing module 216 may provide the output oftraffic dependency on internal and external network traffic. An exampleof this can be seen in FIG. 7A. Example chart 700 depicts the amount andtype of traffic that goes through a particular virtual machine. Row 710depicts the amount of traffic between the particular virtual machine toexternal entities of the enterprise network 105. Network traffic isseparated by incoming and outgoing network traffic. Similarly, row 720depicts the amount of traffic between the particular virtual machine toother entities, which are not virtual machines, of the enterprisenetwork 105. Row 730 depicts the amount of traffic between theparticular virtual machine and other virtual machines of the enterprisenetwork 105. The traffic analyzing module 216 may output the trafficdependency in forms other than a table. An example of this can be seenin FIG. 7B. An example output interface 750 depicts the same informationas the example chart 700 of FIG. 7A, but in the form of a state diagram.

In one embodiment, the traffic analyzing module 216 may provide atraffic dependency mapping of the various entities or workloads of theenterprise network 105. The dependency mapping of entities or workloadsof the enterprise network may be done iteratively. For example, aninitial internal and external communication map may be produced andreviewed by a customer or, alternately, the external communication mapmay be reviewed by an analytical system. The initial communication mapmay provide an overall view of the enterprise network. The customer oranalytical system may review the overall view of the enterprise networkto identify and filter entities or workloads which are not of interestand tune priorities and data characteristics reveal during eachiteration. An example of an initial communication map may be seen inFIG. 11A. The customer or analytical system may receive an exampleinitial communication map 1100. Subsequent to receiving the initialcommunication map 1100 of FIG. 11A, the customer or analytical systemmay refine the IP addresses or entities to focus on a particular set ofentities to produce a second communication map 1110 of FIG. 11B.Subsequently, a third iteration of the communication map 1120 of FIG.11C may be produced. The initial communication map 1100, the secondcommunication map 1110 and the third communication map 1120 may be usedto determine or identify bully virtual machines and zombie virtualmachines. A bully virtual machine is a virtual machine that utilizes toomany resources and causes other virtual machines to be withoutresources. A bully virtual machine may cause cluster performance todegrade. Identifying bully virtual machines may help in analyzingwhether one or more of these virtual machines need additional resourcesor need to be re-routed to other applications or workloads.

A zombie virtual machine is inactive or is used by very few or noapplications or workloads. In one example, a virtual machine isconsidered a zombie when it is powered on but does fewer than 30 IOPSand receives or transfers fewer than 1000 bytes per day for the past 30days. To prevent host resource wastage, zombie virtual machines need tobe removed or re-routed to other applications or workloads.

In some embodiments, the traffic analyzing module 216 may receivenetwork traffic data from the network traffic analyzing softwareplatform 150 or the flow source discovery system 170 after the networktraffic analyzing software platform 150 has performed flow sourcedetection for a predetermined period of time. In some embodiments, thepredetermined period of time is at least two weeks.

The scheduling module 218 may receive from the input module 206, thestart time or end time of one or more of the phases of the cloudmigration readiness process. In some embodiments, the scheduling module218 may suspend the cloud migration readiness process or any phase ofthe cloud migration readiness process when any number of triggerconditions is satisfied.

The workload datastore 220 may be any structure and/or structuressuitable for storing data entries or records (e.g., an active database,a relational database, a self-referential database, a table, a matrix,an array, a flat file, a documented-oriented storage system, anon-relational No-SQL system, an FTS-management system such asLucene/Solar, and the like). The workload datastore 220 may store therepresentative synthetic workload associated with each affinity group.In some embodiments, the workload datastore 220 may create a workloadentry for each workload identified by the migration module 204. Eachworkload entry may include metrics or attributes associated with theworkload. The attributes of the workload may depend on what the workloadrepresents. For example, if the workload represents an application, theattributes of the workload may include attributes of the applicationsuch as identifiers of the entities associated with the enterprisenetwork 105, tier, or criticality of the application. In anotherexample, if the workload represents a virtual machine, attributes of theworkload may include attributes of the virtual machine such as maximumread speed, maximum write speed, central processing unit (CPU) MHz,memory utilization percentage, storage demand, and IOPS.

The cloud service provider profile datastore 222 may be any structureand/or structures suitable for storing data entries or records (e.g., anactive database, a relational database, a self-referential database, atable, a matrix, an array, a flat file, a documented-oriented storagesystem, a non-relational No-SQL system, an FTS-management system such asLucene/Solar, and the like). The cloud service profile datastore 222 maystore a CSP profile entry for various CSPs such as Microsoft Azure, IBMCloud, and the like. Each CSP profile entry may include attributes ofthe CSP such as available memory storage, types of security levelsavailable, cost per gigabyte, methods of retrieving data stored on thecloud, and types of deployment available to a consumer. The migrationmodule 204 may utilize the cloud service profile datastore 222 tosuggest one or more CSP to the customer.

The reporting module 224 may receive a request to provide an exampleoutput the network traffic between a particular virtual machine andexternal entities such as the example output 800 of FIG. 8. During thediscovery phase of the cloud migration readiness process, the reportingmodule 224 may provide the example output 800, which depicts a virtualmachine 810, given an identifier “ORDDB02.” The example output 800 alsodepicts identifiers of other virtual machines that are in communicationwith the “ORDDB02” virtual machine. Element 802 of FIG. 8 depicts anentity external to the enterprise network, or an external entity that isin communication with the “ORDDB02” virtual machine. The reportingmodule 224 may receive a request to provide example outputs from variousphases of the cloud migration readiness process such as the exampleworkload utilization table 1500 of FIG. 15.

The flow source datastore 222 may be any structure and/or structuressuitable for storing data entries or records (e.g., an active database,a relational database, a self-referential database, a table, a matrix,an array, a flat file, a documented-oriented storage system, anon-relational NoSQL system, an FTS-management system such asLucene/Solar, and the like). The flow source datastore 222 may receive arequest from the communication module 202 to create or update a flowsource entry. The flow source entry may include attributes and/ormetrics of the discovered flow source. Attributes and/or metrics of thediscovered flow sources may be organized to obtain statistics or metricssuch as top conversations as seen by each software platform, top IPaddress by total bit rate, and top IP address by receive or transmit bitrate.

A module may be hardware or software. In some embodiments, the modulemay configure one or more processors to perform functions associatedwith the module. Although different modules are discussed herein, itwill be appreciated that the content delivery system 106 may include anynumber of modules performing any or all functionality discussed herein.

FIG. 3 depicts a flowchart of a cloud migration readiness process 300 ofan enterprise system according to some embodiments. The cloud migrationreadiness process 300 includes a discovery phase 302, a profiling phase304, a playback phase 306, and a monitor phase 308.

During the discovery phase 302, the CMR service system 185 may identifyapplications and data flow on the enterprise network to determine aninitial internal and external communication map. In some embodiments,the customer may provide business objectives, known applications of theenterprise network, a targeted workload which may includemission-critical applications or virtual machines that have been causingproblems, critical peak business time period, and desired completiondates. The CMR service system 185 may use some or all of thisinformation during the discovery phase 302 and other phases of the cloudmigration readiness process to generate a report identifying workloadsand the cost of migrating the identified workload to different CSPs.Some example output of the discovery phase 302 may be targeted workloadinventory, target workload dependency matrices, and a baselineassessment of the health, utilization, and performance aspects of theworkloads' on-premises infrastructure. In some embodiments, thediscovery phase 302 may have a duration between 2 to 4 weeks. Thecustomer may receive some or all of the output of the discovery phase302 to determine workloads to profile in the profiling phase 304 of thecloud migration readiness process. The determination of the workloadsmay be done based on the customer's goals. For example, based on thecharacterization of the applications of the enterprise network, thecustomer may decide to migrate a database application to a cloud-basedinfrastructure—diagram 1200 of FIG. 12A depicts an example of multipleapplication's external and internal dependencies before migration. Asseen in diagram 1200, the internal and external dependencies of threecategories of applications of the enterprise network 105 can be seen.For example, the analysis application is dependent on an internal SMBapplication and an external HTTP application.

During the profiling phase 304, the CMR service system 185 may receivefrom the customer, workloads to profile, and categorize the workloadsinto affinity groups. The number of workloads profiled in this phase ofthe cloud migration readiness process may range from hundreds tothousands. Workloads may be categorized into affinity groups based onutilization levels and temporal characteristics. The workload profilingincludes CPU, memory, IO, and network utilization for all on-premisesworkloads that have been targeted for migration to the cloud. It will beappreciated that in some embodiments, the affinity groups may each be arepresentative synthetic workgroup. Alternately, in some embodiments,once affinity groups have been created, the CMR service system 185creates representative synthetic workloads for each affinity group.

In various embodiments, the representative synthetic workload may be asum of the multiple workloads. Based on the representative syntheticworkloads, the CMR service system 185 may select initial cloudconfiguration choices and presented to the customer. Some example outputof the profiling phase may include targeted workload profile, workloadaffinity group definitions, synthetic workloads, candidate cloudconfiguration, and candidate cloud configuration costs. In someembodiments, the profiling phase 304 may have a duration of 2 weeks. Thecustomer may receive some or all of the output of the profiling phase todetermine workloads for the playback phase.

During the playback phase 306, the CMR service system 185 may targetworkloads to target for the playback phase and plays back the workloadsinto a profile of different CSPs. In some embodiments, the CMR servicesystem 185 may select one or more synthetic representative workloads astarget workloads. In various embodiments, a user may select the one ormore synthetic representative workloads as target workloads. It will beappreciated that, in some embodiments, all of the syntheticrepresentative workloads are target workloads.

The output of the playback may be a simulated performance of theworkload(s) on a particular CSP (or a variety of CSPs). The on-premisesperformance level is compared to the simulated performance, and costsestimates are re-calculated. Some example output of the playback phase306 includes a synthetic workload cloud performance report, an updatedcandidate cloud configuration, and an updated candidate cloudconfiguration costs. The output of the playback phase 306 may be one ormore recommendations of which workloads of the enterprise network tomigrate to a CSP, and which CSP may be best suited for the customer'sneeds. In some embodiments, the playback phase 306 may have a durationof 2 weeks. The customer may receive some or all of the output of theplayback phase to determine workloads or applications to migrate to aCSP and a particular CSP to use. Diagram 1250 of FIG. 12B depicts anexample of multiple application's external and internal dependenciesafter migration. As seen in diagram 1250, the CMR service system 185 mayprovide a recommendation to all internal applications except the SMBapplication to a cloud-based infrastructure.

The optional monitor phase 308 takes place after the customer migratesthe workload or application to a CSP. During the monitor phase 308, theCMR service system 185 verifies that the applications' performanceremains within acceptable levels. Some example output of the monitorphase may include cloud workload performance report and cloudconfiguration report and post-migration recommendations. In one example,the monitor phase 308 may have a duration of 4 weeks. The customer mayreceive some or all of the output of the monitor phase, determine iffewer or more resources from the cloud infrastructure are required.Further details of each of the phases of the cloud migration readinessprocess 300 are discussed in FIGS. 4, 13, 18, and 21.

FIG. 4 depicts in further detail the discovery phase 302 of the cloudmigration process according to some embodiments. In step 402, the inputmodule 206 may receive one or more cloud migration objectives. Cloudmigration objectives may include a request that the playback phase iscompleted before a particular date so that the enterprise may make adecision regarding the cloud migration of one or more applications ofthe enterprise network. In some embodiments, cloud migration objectivesmay include one or more choices of CSP or a required level of securityfor some or all of the applications or workloads that need to bemigrated to a cloud infrastructure, a required level of performance forsome or all applications or workloads that need to be migrated to thecloud infrastructure, and/or the like.

In various embodiments, the migration module 204 may create an inventoryof workloads of the enterprise network 105. The migration module 204 maysend a request to the reporting module 224 to provide an inventory tableor inventory chart, documenting the workloads of the enterprisenetwork's on-premises infrastructure. The inventory table may includethe workloads' on-premises configuration, such as the number of virtualcentral processing units (vCPUs), memory size, and configured storage.The information collected may serve as a reference to understand theon-premise resource demands and requirements of the targeted workloads.One or more phases of the cloud migration readiness process may requireat least some of the cloud migration objectives obtained step 402.

In step 404, the CMR service system 185 may send a request to theapplication discovery system 180 to discovery applications of theenterprise network 105. The application discovery system 180 may receivefrom the flow source discovery system 170 possible roles of networkendpoints. These possible network endpoint roles may be used by theapplication discovery system 180 to discover applications throughheuristic analysis. The output of the application discovery system 180may be a list of applications on the enterprise network, and entities ofthe enterprise system associated with each of the applications. Theapplication discovery system 180 may send the list of applications tothe application discovery interface module 208. The migration module 204may send a request to the workload datastore 220 to create a workloadentry for one or more applications in the list of applications receivedfrom the application discovery system 180. Further details of theapplication discovery process are discussed in FIG. 5.

In step 406, the CMR service system 185 may send a request to the flowsource discovery system 170 to determine one or more flows of data inthe enterprise network. A flow in an enterprise network may represent acommunication between a source internet protocol (IP) address and adestination IP address. The output of the flow source discovery system170 may include a list of flow source entries. The list of flow sourceentries may include attributes associated with discovered flow sources.Attributes may include the type of flow source, total byte count,incoming/outgoing byte count, incoming/outgoing bit rate, total packetrate, and/or incoming/outgoing endpoint count. In some embodiments,attributes associated with flow source entries may include applicationsassociated with the flow source. The flow source discovery system 170may send the list of flow source entries to the flow source discoveryinterface module 214. The migration module 204 may store the list offlow source entries to the flow source datastore 226. Further details ofthe flow source discovery process are discussed in FIG. 6.

Using data from the application discovery system 180, and the flowsource discovery system 170, the CMR service system 185 may be able tocreate an on-premise inventory of workloads of the enterprise network105. Workloads of the enterprise network 105 may be entities orapplications of the enterprise network 105. In some embodiments, thereporting module 224 may provide to the customer an inventory table orinventory chart, documenting the workloads of the enterprise network'son-premises infrastructure. The inventory table may include theworkloads' on-premises configuration, such as the number of virtualcentral processing units (vCPU), memory size, and configured storage.The information collected may serve as a reference to understand theon-premise resource demands and requirements of the targeted workloads.

In step 408, the traffic analyzing module 216 analyzes network trafficreceived from the flow source discovery system 170. The trafficanalyzing module 216 may receive network traffic data from a “peakbusiness” period. The peak business period may be a period of at leastone week. The data received from the flow source discovery system may bestored in the flow source datastore 226. The traffic analyzing module216 may determine the amount of data traffic that originates orterminates at a particular virtual machine or another entity of theenterprise network 105 and output this information to the customer inthe form of a table or a graphic. An example of this output may be seenin FIGS. 7A and 7B. Example chart 700 of FIG. 7A depicts the amount andtype of traffic that goes through a particular virtual machine. Row 710depicts the amount of traffic between the particular virtual machine toexternal entities of the enterprise network 105—example diagram 750 ofFIG. 7B depicts the same information as the example chart 700 of FIG.7A. Virtual machine 760 represents the particular virtual machine, whileelement 770 represents all entities external to the enterprise network105 which is in communication with the virtual machine 760. Arrows 780and 785 depicts the directional of the data traffic and the amount ofdata traffic.

In step 410, the workload module 210 may identify any number ofworkloads of the enterprise network 105 and the interdependencies ofthose workloads. In some embodiments, the interdependencies may beutilized to assist in identifying workloads.

In some embodiments, the traffic analyzing module 216 may receive arequest from the workload module 210 for network traffic between two ormore workloads of the enterprise network 105. The workload module maydetermine the amount of data traffic that originates from a particularapplication of the enterprise network 105. Example application networktraffic diagram 900 of FIG. 9, which depicts an example application,“Great_Plains_App,” and the external entities which this applicationcommunications with. Furthermore, the example application networktraffic diagram 900 depicts an average amount of network traffic thatoriginates or terminates at the “Great_Plains_App” application.

When the workload module 210 identifies a workload, the workload modulemay send a request to the workload datastore 220 to create a workloadentry. Each workload entry may include metrics or attributes associatedwith the workload. The attributes of the workload may depend on what theworkload represents. For example, if the workload represents a virtualmachine, the attributes of the workload may include attributes of thevirtual machine such as maximum read speed, maximum write speed, centralprocessing unit (CPU) MHz, memory utilization percentage, storagedemand, and IOPS.

In optional step 412, the workload module 210 may generate “what if”workload movement scenarios, which exposes possible scenarios to aid indeciding to migration one or more workloads based on their bandwidthconsumption, dependency on other workloads, and the potential costassociated with which scenario or cloud-on premises networkconfigurations—for example, FIG. 10A depicts three examples of “what if”workload movement scenarios.

In “what if” scenario 1000, six workloads were chosen to behypothetically moved to a cloud-based infrastructure such as MicrosoftAzure. The workload module 210 may determine the bandwidth requirementfor these six virtual machines. The workload module 210 may determinethe sum of the amount of network traffic between the six virtualmachines, the amount of incoming and outgoing network traffic betweenany one of the six virtual machines and other virtual machines orentities of the enterprise network 105, and the amount of incoming andoutgoing network traffic between any one of the six virtual machines andother entities outside the enterprise network. The sum of these maydetermine the bandwidth requirement of the six virtual machines. Theworkload module 210 may send a request to the cloud service providerprofile datastore 222 for the Azure CSP profile entry. The workloadmodule 210 may determine the memory storage requirement, the requiredtype of security, and cost per gigabyte to estimate the cost of storingthe six workloads into Azure. The reporting module 224 may receive arequest from the workload module 210 to provide an estimated cost permonth of storing the “what if” scenario 1000 in Azure. Row 1050 of chart1040 of FIG. 10B provides the estimated cost per month of storing the“what if” scenario 1000 in Azure, along with the bandwidth requirementof the six virtual machines.

In “what if” scenario 1020, five workloads were chosen to behypothetically moved to Microsoft Azure. The workload module 210 maydetermine the bandwidth requirement for these five virtual machines. Theworkload module 210 may determine the sum of the amount of networktraffic between the five virtual machines, the amount of incoming andoutgoing network traffic between any one of the five virtual machinesand other virtual machines or entities of the enterprise network 105,and the amount of incoming and outgoing network traffic between any oneof the five virtual machines and other entities outside the enterprisenetwork. The sum of these may determine the bandwidth requirement of thefive virtual machines. The workload module 210 may send a request to thecloud service provider profile datastore 222 for the Azure CSP profileentry. The reporting module 224 may receive a request from the workloadmodule 210 to provide an estimated cost per month of storing the “whatif” scenario 1020 in Azure. Row 1060 of chart 1040 of FIG. 10 providesthe estimated cost per month of storing the “what if” scenario 1010 inAzure, along with the bandwidth requirement of the five virtualmachines.

In “what if” scenario 1030, four workloads were chosen to behypothetically moved to Microsoft Azure. The workload module 210 maydetermine the bandwidth requirement for these four virtual machines. Theworkload module 210 may determine the sum of the amount of networktraffic between the four virtual machines, the amount of incoming andoutgoing network traffic between any one of the four virtual machinesand other virtual machines or entities of the enterprise network 105,and the amount of incoming and outgoing network traffic between any oneof the four virtual machines and other entities outside the enterprisenetwork. The sum of these may determine the bandwidth requirement of thefour virtual machines. The workload module 210 may send a request to thecloud service provider profile datastore 222 for the Azure CSP profileentry. The reporting module 224 may receive a request from the workloadmodule 210 to provide an estimated cost per month of storing the “whatif” scenario 1030 in Azure. Row 1070 of chart 1040 of FIG. 10 providesthe estimated cost per month of storing the “what if” scenario 1020 inAzure, along with the bandwidth requirement of the four virtualmachines.

In step 414, the reporting module 224 may receive a request from theworkload module 210 to provide one or more of the targeted workloadinventory, target workload dependency matrices, and a baselineassessment of the health, utilization, and performance aspects of theworkloads' on-premises infrastructure. Examples of the output of thediscovery phase 302 can be seen in FIG. 7A through 11C. Based on the“what if” scenarios and other output of the discovery phase 302, the ITadministrator of the enterprise network may 105 identify and fine-tuneapplications or workloads to target for cloud migration.

FIG. 5 depicts in further detail of an application discovery step of thediscovery phase according to some embodiments. In step 502, theapplication discovery system 180 may function to determine if one aplurality of trigger conditions is satisfied. The application discoverysystem 180 may receive a notification or indication that one of theplurality of trigger conditions has been satisfied. The triggerconditions may include a request to commence the application discoveryprocess, a current time equaling a start time of a scheduled applicationdiscovery process, a signal, or resource utilization of one or moreentities if less than an entity utilization threshold.

In optional step 504, the application discovery system 180 may receivefrom the IT administrator a list of applications running on theenterprise network 105 and entities of the enterprise network 105associated with each of the plurality of applications. In someembodiments, the application discovery system 180 is configured toreceive attributes of any number of the applications running on theenterprise network 105 and attributes of each of the entities associatedwith each of the plurality of applications.

In various embodiments, the application discovery system 180 may createand store any number of discovered application entries based oninformation received from the IT administrator.

In optional step 506, the application discovery system 180 determinesthe infrastructure of the enterprise network 105. In some embodiments,the application discovery system 180 discovers attributes of any numberof entities of the enterprise network 105 and creates and stores entityentry. Building an infrastructure of the enterprise network 105 may aidusers of the application discovery system 180 with a visualrepresentation of the infrastructure in the context of key applicationsof the enterprise.

In step 508, the application discovery system 180 may receive dataregarding applications, the data received regarding the application mayinclude attributes of the application, such as the name, the number ofentities making up the application, the tier mapping of the application.The data received regarding the application may include attributes ofeach of the entities associated with the application. Attributes of theentities may include entity category, entity type, speed of the channel,and alarms. Some entity attributes may be dependent on the type ofentity; for example, fiber channels may have an attribute describing thespeed of the channel.

The application discovery system 180 may receive data from the ITmanagement software platform subscribed to by the enterprise network105, such as ServiceNow. In various embodiments, the applicationdiscovery system 180 may receive data regarding discovered applicationsfrom other IT management software platforms. In various embodiments, theapplication discovery system 180 may create or update entity entrieswith data received from ServiceNow or other IT management softwareplatforms.

In some embodiments, if the application discovery system 180 discoversthat a particular application has not changed in the last number ofiterations of the application discovery process. In such a case, theapplication discovery system 180 may choose to limit the applicationdiscovery process to avoid re-identification and/or re-discovery of asubset of applications periodically. In various embodiments, the numberof iterations which triggers the periodic discovery of an applicationmay change according to attributes of the particular application, suchas tier or criticality of the particular application.

The application discovery system 180 may receive data from applicationperformance software platforms subscribed to by the enterprise network105, such as AppDynamics. The application discovery system 180 maycreate or update entity entries with data received from AppDynamics orother application performance software platforms.

In some embodiments, if the application discovery system 180 discoversthat a particular application has not changed in the last number ofiterations of the application discovery process. In such a case, theapplication discovery system 180 may choose to identify or discover theapplication periodically. In various embodiments, the number ofiterations which triggers the periodic discovery of an application maychange according to attributes of the particular application, such astier or criticality of the particular application.

In step 510, the application discovery system 180 may receive a requestfrom the flow source discovery system 170 to accept flow records betweentwo IP addresses. The application discovery system 180 may receive flowrecords from switches that enable a network protocol that provides theability to collect IP network traffic using software such as NetFlow.These flow records may be analyzed by the application discovery system180 to determine possible network endpoints and possible applications onthe enterprise network 105.

In some embodiments, the application discovery system 180 retrieves flowrecords from NetFlow during scheduled retrieval periods. In variousembodiments, the application discovery system 180 retrieves flow recordswhen the application discovery system 180 determines that theutilization of switches enabled with the NetFlow software is below theentity utilization threshold.

In some embodiments, the application discovery system 180 receives flowdata to and from storage devices 110. Probe data may include IP address,probe type, network address, speed of the channel and status of theprobe, number of CPUs, operating system (OS) version, and applicationsrunning on the host.

In step 512, the application discovery system 180 may receive thenetwork traffic data from the network traffic analyzer software platform150. In some embodiments, the application discovery system 180 suggests,based on heuristic implications, applications that could exist. Theresult of the implications may be a possible discovered application. Forexample, the application discovery system 180 may observe that aparticular IP address is the flow source/destination to/from thousandsof seemingly random IP addresses and determine that the particular IPaddress belongs to an edge device.

In another example, through SSH or WMI, the application discovery system180 may determine that one of the host 120 of the enterprise network105, which is part of the SAP, is running out-of-date software, however,that particular host 120 may have been replaced with different software.The out-of-date software may not have been removed from one of the host120. The attributes of the SAP application, as well as attributesassociated with the out-of-date software running on one of the host 120,may be sent to the application discovery system 180.

In various embodiments, the application discovery system 180 may performa heuristic analysis of the attributes of any number of entities of theenterprise network 105. Attributes may include the name of the entitywhen an entity was introduced to or became a part of the enterprisenetwork 105. Attributes may be used to determine if any number ofentities is a part of an application. For example, entities with namescontaining a prefix or suffix that are the same may be a part of thesame application.

In some embodiments, a time when entities of the enterprise network areintroduced into the enterprise network may be analyzed and compared withan entity's introduction threshold that may be used to determinepotential applications. For example, entities introduced to theenterprise network 105 within the entity's introduction threshold of 5minutes may be part of the same application; in either case, theapplication discovery system 180 may create a discovered applicationentry for each of the potential applications. The entities' introductionthreshold may be set by the IT administrator or may be set by theapplication discovery system 180. In various embodiments, theapplication discovery system 180 may suggest that two particularentities of the network may comprise an application if the twoparticular entities are in constant contact throughout the day, withamount of IP traffic passing back and forth between the two particularentities is more than any other pair of entities of the network.

In step 514, the application discovery system 180 outputs a list ofdiscovered application entries and/or a plurality of entity entries. Theapplication discovery system 180 may output any number of the discoveredapplication entries in the form of a chart, with each discoveredapplication entry as well as application attributes displayed in textform. In some embodiments, entities associated with each discoveredapplication, as well as attributes associated with each entity, may bedisplayed in text form.

Attributes of the discovered application entry output by the applicationdiscovery system 180 may include the software platform responsible forthe application associated with the discovered application entry. Otherattributes include tier mapping of applications discovered by differentnetworks, names of the application. Attributes of the entities mayinclude entity category, entity type, speed of the channel, and/oralarms. Some entity attributes may be dependent on the type of entity;for example, fiber channels may have an attribute describing the speedof the channel.

In some embodiments, an application conflict may be provided by theapplication discovery system 180 to the IT administrator to be resolved.Consider an example, if AppDynamics identifies a first SAP applicationwith eight entities, including three cloud-based storage devices andfour locally-based storage devices. The application discovery system 180implies a second SAP application with the same eight entities, includingthe three cloud-based storage devices and the four locally-based storagedevices, as the first SAP application plus an additional cloud-basedstorage device which is not shown in the first SAP application. Thediscovered application entry may be created for each of the SAPapplication and the application conflict may be outputted by theapplication discovery system 180. The application conflict may beresolved by the IT administrator.

In various embodiments, the application discovery system 180 may resolvethe conflict without assistance from the IT administrator. In variousembodiments, the application discovery system 180 may resolve theconflict by using the tier mapping of software platforms. For example,the IT administrator may choose to prioritize applications discovered byServiceNow over applications discovered by AppDynamics, such that ifthere is an application conflict between applications discovered byServiceNow and AppDynamics, the conflict will be automatically resolvedby the application discovery system 180 by choosing the applicationdiscovered by ServiceNow as the correct one.

Once entities of the enterprise network 105 have been identified, datafrom the network software platforms and network probes may have beenreceived and analyzed by the application discovery system 180, and theapplication discovery process may proceed to step 516. In step 516, aniteration of the application discovery process is complete. The outputof the application discovery system 180 may output to the CMR servicesystem 185 a list of application entries on the enterprise network 105,and entities of the enterprise system associated with each of theapplications.

In some embodiments, the iteration application discovery process may bedeemed as complete after the application discovery system 180 receivesdata from software platforms and network probes for a predeterminedperiod of time. In some embodiments, the predetermined period of time isseven days. In various embodiments, the predetermined period of time is24 hours. In one embodiment, the predetermined period of time is set bythe IT administrator. In some embodiments, the iteration applicationdiscovery process may be deemed as complete if the application discoverysystem 180 determines that a duplicated application counter is greaterthan a duplicated application threshold.

Other details and features of the application discovery process may beto suspend the application discovery process and creating a bookmark ofthe last network data received from the network traffic monitoringplatform, a request to suspend the application discovery process may betriggered when a suspension trigger condition is satisfied, for example,which may be combinable with those described here, can be found in U.S.patent application Ser. No. 16/234,353, filed on Dec. 27, 2018; thecontents of which is hereby incorporated by reference in its entirety.

FIG. 6 depicts a flowchart of a flow source discovery process of anenterprise network according to some embodiments. In step 602, the flowsource discovery system 170 may execute the flow source discovery. Insome embodiments, the flow source discovery system 170 may receive arequest to start the flow source discovery process when any number oftrigger conditions are satisfied. For example, if a current time equalsa predetermined start time, a trigger condition may be satisfied.

In optional step 604, the flow source discovery system 170 may determineany number of attributes and/or metrics of discovered flow sources tomonitor and provide. The flow source discovery system 170 may provide aset of attributes of discovered flow sources. The set of attributesand/or metrics may include the type of flow source, total byte count,incoming/outgoing byte count, incoming/outgoing bit rate, total packetrate, and/or incoming/outgoing endpoint count. In the subsequent flowsource discovery process, the flow source discovery system 170 maymonitor and output a subset of attributes of discovered flow sources.

In step 606, the flow source discovery system 170 may receive IP networktraffic data from any number of network traffic analyzing softwareplatforms 150 and/or TAP 140. The IP network traffic data may be in datapackets. Data packets collected from different routers and switches withdifferent network traffic analyzing software platforms may be indifferent formats. In some embodiments, the flow source discovery system170 may store any number of the data packet entries associated with eachof the data packets received from the network traffic analyzing softwareplatform 150.

In optional step 608, the flow source discovery system 170 may determineany number of entities of the switch fabric to monitor. In an initialflow source discovery process, the flow source discovery system 170 mayanalyze flow records associated with all entities of the switch fabric.In response to the output of the initial flow source discovery process,the flow source discovery system 170 may receive from the ITadministrator of the enterprise network 105, a list of entities of theswitch fabric that the IT administrator would like to continuemonitoring. The flow source discovery system 170 may store the list. Insubsequent flow source discovery process, the flow source discoverysystem may ignore or reject flow records from entities of the switchfabric not listed in the first list.

In step 610, the flow source discovery system 170 may analyze any numberof received data packets and determine a flow source of flow records. Insome embodiments, the flow source discovery system 170 does not begin toanalyze any number of data packets until the end of the time frame. Invarious embodiments, the flow source discovery system 170 analyzes anynumber of data packets as it is being received by the flow sourcediscovery system 170.

In step 612, the flow source discovery system 170 may provide any numberof flow source entries to an interface or report. For example, the flowsource discovery system 170 may provide any number of flow sourceentries in the form of a chart, with each discovered flow source entryas well as attributes associated with discovered flow sources displayedin text form. In some embodiments, entities of the enterprise network105 found along the data path associated with the discovered flow sourceentry, as well as attributes associated with each entity, may bedisplayed in text or in the form of an infrastructure topology view.

In step 614, the flow source discovery system 170 may build or updatethe infrastructure of the enterprise network 105. In some embodiments,as any number of flow source entries are created or updated, the flowsource discovery system 170 may obtain more information regarding theconnectivity of entities of the enterprise network 105.

The flow source discovery system 170 may provide other informationbesides the connectivity of entities in the enterprise network 105. Forexample, the representation of entities of the enterprise network 105may include alarms or alerts associated with one or more entities.

In some embodiments, once initiated, the flow source discovery processmay continue until it is completed. In step 616, the flow sourcediscovery system 170 may determine that the flow source discoveryprocess is complete after retrieving traffic data from the one or morenetwork traffic analyzing software platform for a fixed interval oftime. In various embodiments, the flow source discovery system 170 maydetermine that the flow source discovery process is complete when theflow source discovery time frame is over.

In step 618, in response to the displaying or report any number of flowsource entries, the flow source discovery system 170 may receiveinformation from the IT administrator. The received feedback may includea first list containing any number of entities of the switch fabric thatthe IT administrator wants to continue monitoring. In some embodiments,the received feedback includes a second list containing any number ofattributes of the switch fabric which the IT administrator would like tocontinue monitoring.

The second list may be used in step 604 to determine any number ofattributes or metrics of discovered flow sources to monitor and providein subsequent flow source discovery processes. The first list may beused in step 608 to determine any number of entities of the switchfabric to monitor and provide in subsequent flow source discoveryprocesses.

Other details and features of the flow source discovery process may beto suspend the flow source discovery process may further compriseidentifying a flow packet as belonging to one of at least two flowpackage types based on a format, for example, which may be combinablewith those described here, can be found in U.S. patent application Ser.No. 16/234,402, filed on Dec. 27, 2018; the contents of which is herebyincorporated by reference in its entirety.

FIG. 13 depicts in further detail of the profiling phase 304 of thecloud migration process according to some embodiments. During theprofiling phase 304, analytics are applied to the workloads that werecharacterized during the discovery phase 302. Depending on theorganization's goals, the number of workloads under consideration mayrange from hundreds to thousands. In some embodiments, the first step inthe profiling phase 304 may be to utilize the workload characterizationdata (e.g., attributes) to produce affinity groups.

The workload characterization or attribute data may include, forexample, CPU, memory, IO, and network utilization for all or someon-premise workloads that have been targeted for migration to the cloud.

The affinity groups may each include workloads with similar resourceutilization levels and temporal (time-based) characteristics. In someembodiments, the affinity group module 206 associate workloads intogroups based on their utilization levels. It may be appreciated that theworkloads may be associated into groups in many different ways.

In step 1302, the migration module 204 may send a request to theworkload datastore 220 for the workloads discovered in the discoveryphase 302. The discovery output may include workload characteristics andinterdependencies among compute, network, and storage elements of anon-premises enterprise system.

In step 1304, the affinity group module 212 may categorize workloadsidentified by the workload module 210 into affinity groups. In someembodiments, the affinity group module 206 may receive performancemetrics. In some embodiments, performance metrics may includeutilization metrics. It will be appreciated that the metrics may beindependent of any cloud service provider.

Utilization metrics may be received from any number of differentsources. In some embodiments, the utilization metrics and measurementsmay be reported from applications, virtual machines, hypervisors,operating systems, applications, servers, or third-party performanceservice providers (e.g., NetFlow or ServiceNow). In some embodiments,the utilization metrics may include any number of the following:

1. CPU Utilization

2. Memory Utilization

3. IO Read Utilization

4. IO Writes Utilization

5. IO Number of Reads

6. IO Number of Writes

7. Network Receive Rate

8. Network Transmit Rate

Affinity groups may consist of workloads with similar resourceutilization levels and temporal or time-based characteristics. Forexample, workloads with similar CPU utilization, IO number of reads, andIO number of writes may be grouped into the same affinity group. In someembodiments, a workload may belong to more than one affinity group. Inother embodiments, each workload may only belong to one affinity group.

In one method, the CMR service system 185 may utilize a machine learningalgorithm to categorize or group workloads into affinity groups. In someembodiments, the workload module may apply a k-means clusteringalgorithm to the multiple workloads identified by the workload module210. The k-means clustering algorithm may have a feature seatrepresented by average, a percentile of maximum values of utilizationmetrics. In some embodiments, utilization metrics include CPUutilization, memory utilization, input/out (IO) read utilization; IOwrite utilization, IO number of reads, IO number of writes, networkreceive rate, and network transmit rate.

In some embodiments, the CMR service system 185 applies a k-meansclustering algorithm with a feature set represented by average,percentile of maximum values of the utilization metrics. This method maybe independent of the cloud service provider and relies solely on theperformance of the workloads.

K-means clustering aims to partition n observations into k clusters inwhich each observation belongs to the cluster with the nearest mean,serving as a prototype of the cluster. This results in a partitioning ofthe data space into Voronoi cells. K-means minimizes within-clustervariances such as squared Euclidean distances.

In one example, given a set of utilization metrics measurements (x₁, x₂,. . . , x_(n)), where each utilization metrics measurement is ad-dimensional real vector, the affinity group module 212 may utilizek-means clustering to partition the n utilization metrics measurementinto k(≤n) sets S={S₁, S₂, . . . . S_(k)} so as to minimize thewithin-cluster sum of squares (WCSS) (i.e., variance). The objective maybe to find:arg_(S)minΣ_(i=1) ^(k)Σ_(x∈S) _(i) ∥x−μ _(i)∥²=arg_(S)minΣ_(i=1) ^(k) |S_(i)|VARS _(i)where μ_(i) is the mean of points in S_(i).

In another method, the affinity group module 212 groups workloads bytheir maximum or percentile utilization metric fitness into availablecloud instances for a specific CSP. This method may be utilized when aparticular CSP to use has already been determined. There can be othermethods achieving the same goal of grouping workloads in addition to twodescribed above. As a result of such grouping, selection of a cloudinstance for a group means selection of the cloud instance for allmembers of the group and, thus, a process of selecting thousands ofinstances and verification of the performance is reduced to selectionand verification of several dozens of instances.

Once the affinity group module 212 determines the workloads that belongto each affinity group, the affinity group module may determine therepresentative synthetic workload for each affinity group. Therepresentative synthetic workload may reduce playback time by capturingrelevant utilization attributes of the workloads within an affinitygroup.

In one example, time slices of a predetermined time duration (e.g.,between 30 min-60 min long) may be selected containing the maximumperformance values for each of the metrics among all virtual machineswithin the affinity group. A time slice may have statistics on allmetrics for a chosen virtual machine containing a maximum value of aspecific metric. Next, the all selected time slices may be concatenatedto build a synthetic representative workload for an affinity group. Itmay be constructed by concatenating temporal segments of variousworkloads to preserve relevant utilization levels for the group. Theresult is a high-fidelity synthetic representation of the hundreds orthousands of workloads.

It may be appreciated that armed with synthetic representativeworkloads, the number of workloads that require verification in thecloud is significantly reduced. The complexity and scale are condensedto a manageable set without losing the original and criticalcharacteristics of the on-premise workloads.

The representative synthetic workload for each affinity group may be asum of the multiple workloads which make up the affinity group. Invarious embodiments, the representative synthetic workload for eachaffinity group may be a weighted sum of the multiple workloads whichmake up the affinity group, with each of the multiple workloads given aweight based on attributes or characteristics of the workload. In someembodiments, the affinity group module may send a request to theworkload datastore 220 to store the representative synthetic workloadassociated with each affinity group.

The affinity group module 212 may generate a table or chart whichcomprises temporal data capturing utilization level for some or all ofthe utilization metrics during a temporal data capture period. Anexample of this may be seen in FIG. 15. Table 1500 of FIG. 15 containstemporal data capturing utilization levels of two example workloads ofthe enterprise network 105. The columns of the example table 1500 areassociated pairs of date/time of data and the name of the workload thatis being monitored by the infrastructure performance managementappliance 160 for a particular utilization metric. The number of columnpairs is equal to the number of workloads being monitored by theworkload module 212. For example, column 1510 provides a timestamp formeasuring the particular utilization metric, while column 1520 providesthe measurement for the particular utilization metric associated withthe timestamp in the same row.

Once the affinity groups have been created, step 1306 may proceed. Instep 1306, the CMR service system 185 may utilize a machine learningalgorithm to create a representative synthetic workload for eachaffinity group. The representative synthetic workload may reduce thetime required to playback or simulate the workload on a CSP profile bycapturing relevant utilization attributes of the workloads within anaffinity group.

As discussed herein, the affinity group 212 may select a workload timeslice which contains the maximum performance values for each of theutilization metric among all virtual machines within the affinity group.In some embodiments, the workload time slice is predetermined by the CMRservice system 185. In one embodiment, the workload time slice isbetween 30 to 60 minutes long. A workload time slice has statistics onall metrics for a chosen virtual machine containing a maximum value of aspecific metric. A particular affinity group may have workload timeslices of different lengths taken at different time frames of thetemporal data capture period. For example, for a particular affinitygroup, the workload time slice containing a maximum value for memoryutilization may be a 30-minute time slice taken on Monday between 9:00a.m. and 9:30 a.m. For the same affinity group, the workload time slicecontaining a maximum value for CPU utilization may be a 45-minute timeslice taken on Tuesday between 4:30 p.m. and 5:15 p.m. In variousembodiments, a particular affinity group may have workload time slicesof the same length taken at the same time frame of the temporal datacapture period. For example, for the same affinity group, the workloadtime slice containing a maximum value for all utilization metrics may bea 60-minute time slice taken on Friday between 11:00 a.m. and 12:00 p.m.All selected time slices are concatenated to build a representativesynthetic workload for an affinity group. It is constructed byconcatenating temporal segments of various workloads to preserverelevant utilization levels for the group. The result is a high-fidelitysynthetic representation of the hundreds or thousands of workloads.Armed with representative synthetic workloads, the number of workloadsthat require verification in the cloud is significantly reduced. Thecomplexity and scale are condensed to a manageable set without losingthe original and critical characteristics of the on-premise workloads.

An example of affinity groups may be seen in FIG. 14, which depictsaffinity groups and representative synthetic workloads of the enterprisenetwork according to some embodiments. Area 1410 represents all virtualmachines discovered by the CMR service system 185 in the enterprisenetwork 105. Through machine learning algorithms 1420, the virtualmachines are grouped into multiple affinity groups, such as affinitygroup 0 1430, which includes 35 virtual machines and representativesynthetic workload 0 1440. FIG. 16 depicts graphical charts of networktraffic metrics of two example representative synthetic workloadsaccording to some embodiments. For example, charts 1610 through 1640depict utilization metrics of a 4-hour workload for one affinity group,the utilization metrics include memory usage, CPU utilization, readspeed, and write speed. Charts 1650 through 1680 depict the sameutilization metrics of the 4-hour workload for another affinity group.

In step 1308, the reporting module 224 may receive a request from theworkload module to provide one or more of a synthetic workloadperformance report, candidate cloud configuration, and candidate cloudconfiguration cost. Examples of the output of the profiling phase 304can be seen in FIG. 14 through 17.

Based on the representative synthetic workloads and the on-premisesinventory configurated determined during the discovery phase of thecloud migration readiness process, the workload module 220 may select aninitial cloud configuration and estimate the cost of migrating therepresentative synthetic workload onto a CSP. The estimated cost ofmigrating the representative synthetic workload to the CSP can be seenin FIG. 17. Table 1700 of FIG. 17 depicts a candidate CSP computer andon-demand cost of multiple applications and their associated virtualmachines. For example, row 1710 depicts the estimated monthly cost ofmigrating each of the two virtual machines of the “Analysis” applicationto the Azure CSP. The estimated cost is seen in table 1700 of FIG. 17may be a candidate cloud configuration cost. In some embodiments, themigration module 204 may suggest one or more workloads for the playbackphase 306 and one or more CSPs best suited for the needs to the customerbased on the representative synthetic workload, the one or more CSPprofile entries, and the business objectives received from the customerin the discovery phase 302. The customer may receive some or all of theoutput of the profiling phase to determine one or more workloads toplayback on one or more CSP profiles in the playback phase.

FIG. 18 depicts in further detail the playback phase 306 of the cloudmigration process according to some embodiments. In step 1802, the inputmodule 206 may receive from the customer one or more workloads to targetfor the playback phase 306. The migration module 204 may send a requestto the cloud service provider profile datastore 22 for the CSP profileentry of one or more CSPs. Each CSP profile entry may include attributesof the CSP such as available memory storage, types of security levelsavailable, cost per gigabyte, methods of retrieving data stored on thecloud, and types of deployment available to a consumer.

In step 1804, the migration module 204 may send a request to theworkload datastore 220 for the one or more workload to simulate in theplayback phase 306. In some embodiments, the customer may select the oneor more workloads to simulate in the playback phase 306. In variousembodiments, the migration module 204 may make a choice. Using theattributes of the CSP from the CSP profile entry, the migration module204 may emulate the key dimensions of a workload with high fidelity. Thedimensions include CPU MHz, memory utilization in gigabytes, read/writeIOPs, read/write throughputs, and network received/transmit in bytes persecond.

In step 1806, migration module 204 executes or runs the representativesynthetic workload created during the profiling phase 304 of the cloudmigration readiness process. In some embodiments, a CMR playback module(not shown) may execute the representative synthetic workload on top ofthe operating system in the target cloud service provider environmentand configuration.

In step 1808, the performance of the representative synthetic workloadon one or more CSP profiles is compared to the on-premises levels, andcost estimates are re-calculated. In various embodiments, by performingthe representative synthetic workload on a CSP cloud services platform,types of virtual machines on the CSP cloud services platform may beidentified and types of storage (e.g., disk type) on the CSP cloudservices platform may be identified. Periodic (e.g., monthly or yearly)cost on the CSP cloud services platform may be determined based at leastin part the types of virtual machines and the types of storage.

The result of the calculation may be provided by the reporting module224 in the form of a chart, such as a chart 1900 of FIG. 19. The chart1900 depicts a monthly cloud cost estimate comparison of arepresentative synthetic workload of the enterprise network 105 for twoCSPs, Amazon Web Services (AWS) and Microsoft Azure. In one embodiment,the result of the calculation done in step 1806 may be provided by thereporting module 224 in the form of a table, such as a table 2000 ofFIG. 20. The table 2000 depicts a monthly cloud cost estimate ofmultiple applications or workloads of the enterprise network 105 on oneCSP, such as Microsoft Azure. Note that in this example, the estimatedmonthly cost in table 2000 of FIG. 20 is the same as the estimatedmonthly cost seen in table 1700 of FIG. 17.

The cloud migration readiness process 300 is iterative until a cloudconfiguration that meets the performance criteria while minimizing costis found. The goal of the cloud migration readiness process 300 is todetermine a cloud configuration that meets the original on-premiseslevels at the lowest cost. Optionally, enterprises may be interested intesting higher levels of utilization or performance beyond those of theon-premises baseline. In some examples, higher levels of utilization maybe executed as multiple of two times CPU utilization or four times thememory utilization, etc.

The migration module 204 generates utilization levels matching, as muchas possible, the on-premises utilization levels. The on-premiseutilization levels of synthetic workloads are the reference that iscompared to the representative synthetic workload utilization levels inthe cloud. The CMR service system 185 applies adapted linear correlationand relative error to compare cloud utilization values against thereference on-premises utilization values. Some example output of theplayback phase 306 includes a synthetic workload cloud performancereport, an updated candidate cloud configuration, and an updatedcandidate cloud configuration costs. The output of the playback phase306 may be one or more recommendations of which workloads of theenterprise network to migrate to a CSP, and which CSP may be best suitedfor the customer's needs. The customer may utilize this information todetermine which CSP to migrate their on-premises infrastructure to, andwhich CSP to choose.

FIG. 21 depicts in further detail of the monitor phase 308 of the cloudmigration process according to some embodiments. The monitor phase 308takes place after the customer migrates the workload or application to aCSP. The CMR service system 185 may collect data from the applicationdiscovery system 180, the flow source discovery system 170, the networktraffic analyzing software platform 150, and native CSP monitoringsoftware to verify that the applications migrated to the cloudinfrastructure is performing within acceptable levels.

In step 2102, the workload module 210 may receive utilization metricsfrom one or more of the network traffic analyzing software platform 150or the flow source discovery system 170. In step 2104, the workloadmodule 210 may compare received utilization metrics with predeterminedutilization metric thresholds to determine if the applications with oneor more entities migrated to the cloud infrastructure are performing atacceptable levels. The predetermined utilization metric thresholds maybe set by the customer; in some embodiments, the predetermineutilization metric thresholds are set by the CMR service system 185.

In step 2106, the reporting module 224 may provide a utilization andperformance report to the customer. The utilization and performancereport findings include performance trend deviations and recommendationsrelated to the remediation of issues and optimization opportunities.Based on the utilization and performance report, the customer maydetermine if additional cloud infrastructure resources are required.

FIG. 22 is a block diagram illustrating entities of an example machineable to read instructions from a machine-readable medium and executethose instructions in a processor to perform the machine processingtasks discussed herein, such as the engine operations discussed above.Specifically, FIG. 22 shows a diagrammatic representation of a machinein the example form of a computer system 2200 within which instructions2224 (e.g., software) for causing the machine to perform any one or moreof the methodologies discussed herein may be executed. In alternativeembodiments, the machine operates as a standalone device or may beconnected (e.g., networked) to other machines, for instance, via theInternet. In a networked deployment, the machine may operate in thecapacity of a server machine or a client machine in a server-clientnetwork environment, or as a peer machine in a peer-to-peer (ordistributed) network environment.

The machine may be a server computer, a client computer, a personalcomputer (PC), a tablet PC, a set-top box (STB), a personal digitalassistant (PDA), a cellular telephone, a smartphone, a web appliance, anetwork router, switch or bridge, or any machine capable of executinginstructions 2224 (sequential or otherwise) that specify actions to betaken by that machine. Further, while only a single machine isillustrated, the term “machine” shall also be taken to include anycollection of machines that individually or jointly execute instructions2224 to perform any one or more of the methodologies discussed herein.

The example computer system 2210 includes a processor 2202 (e.g., acentral processing unit (CPU), a graphics processing unit (GPU), adigital signal processor (DSP), one or more application-specificintegrated circuits (ASICs), one or more radio-frequency integratedcircuits (RFICs), or any combination of these), a main memory 2204, anda static memory 2206, which are configured to communicate with eachother via a bus 2208. The computer system 2200 may further include agraphics display unit 2210 (e.g., a plasma display panel (PDP), a liquidcrystal display (LCD), a projector, or a cathode ray tube (CRT)). Thecomputer system 2200 may also include alphanumeric input device 2212(e.g., a keyboard), a cursor control device 2214 (e.g., a mouse, atrackball, a joystick, a motion sensor, or other pointing instrument), adata store 2216, a signal generation device 2218 (e.g., a speaker), anaudio input device 2226 (e.g., a microphone) and a network interfacedevice 2220, which also are configured to communicate via the bus 2208.

The data store 2216 includes a machine-readable medium 2222 on which isstored instructions 2224 (e g., software) embodying any one or more ofthe methodologies or functions described herein. The instructions 2224(e g., software) may also reside, completely or at least partially,within the main memory 2204 or within the processor 2202 (e.g., within aprocessor's cache memory) during execution thereof by the computersystem 2200, the main memory 2204 and the processor 2202 alsoconstituting machine-readable media. The instructions 2224 (e g.,software) may be transmitted or received over a network (not shown) vianetwork interface 2220.

While machine-readable medium 2222 is shown in an example embodiment tobe a single medium, the term “machine-readable medium” should be takento include a single medium or multiple media (e.g., a centralized ordistributed database, or associated caches and servers) able to storeinstructions (e.g., instructions 2224) The term “machine-readablemedium” shall also be taken to include any medium that is capable ofstoring instructions (e.g., instructions 2224) for execution by themachine and that cause the machine to perform any one or more of themethodologies disclosed herein. The term “machine-readable medium”includes, but should not be limited to, data repositories in the form ofsolid-state memories, optical media, and magnetic media.

In this description, the term “module” refers to computational logic forproviding the specified functionality. A module can be implemented inhardware, firmware, and/or software. Where the modules described hereinare implemented as software, the module can be implemented as astandalone program, but can also be implemented through other means, forexample as part of a larger program, as any number of separate programs,or as one or more statically or dynamically linked libraries. It will beunderstood that the named modules described herein represent oneembodiment, and other embodiments may include other modules. Inaddition, other embodiments may lack modules described herein and/ordistribute the described functionality among the modules in a differentmanner. Additionally, the functionalities attributed to more than onemodule can be incorporated into a single module. In an embodiment wherethe modules as implemented by software, they are stored on a computerreadable persistent storage device (e.g., hard disk), loaded into thememory, and executed by one or more processors as described above inconnection with FIG. 22. Alternatively, hardware or software modules maybe stored elsewhere within a computing system.

As referenced herein, a computer or computing system includes hardwareelements used for the operations described here regardless of specificreference in FIG. 22 to such elements, including, for example, one ormore processors, high-speed memory, hard disk storage and backup,network interfaces and protocols, input devices for data entry, andoutput devices for display, printing, or other presentations of data.Numerous variations from the system architecture specified herein arepossible. The entities of such systems and their respectivefunctionalities can be combined or redistributed.

The invention claimed is:
 1. A system comprising: at least oneprocessor; and memory including executable instructions that areexecutable by the at least one processor to: discover a plurality ofapplications executing on an enterprise system based on network traffic;discover workload attributes and identify dependencies of the pluralityof applications executing on the enterprise system, the workloadattributes being among compute, network, and storage elements of theenterprise system, the enterprise system including any number ofnetworks, applications on servers, and storage devices which areon-premise; receive utilization performance measurements includingmemory utilization measurements of at least a subset of workloads, eachworkload including the workload attributes and identified dependencies;group workloads based on the workload attributes, the dependencies, andthe utilization performance measurements into affinity groups; determineat least one representative synthetic workload for each affinity group,each representative synthetic workload including a time slice of apredetermined period of time when there are maximum performance valuesfor any number of utilization performance measurements among virtualmachines of that particular affinity group; determine at least one cloudservice provider (CSP)'s cloud services based on performance of therepresentative synthetic workloads; and generate a report for at leastone of the representative synthetic workloads, the report identifyingthe at least one of the representative synthetic workloads and the atleast one CSP's cloud services including cloud workload cost, the cloudworkload cost being based on a periodic cost associated with executingthe at least one of the representative synthetic workload on the atleast one CSP's cloud services.
 2. The system of claim 1, wherein theutilization performance measurements include CPU utilizationmeasurements.
 3. The system of claim 1, wherein the group workloadsbased on the workload attributes, the dependencies, and the utilizationperformance measurements into the affinity groups comprises utilizingk-means clustering to partition at least the utilization performancemeasurements into a number of sets so as to minimize a within-clustersum of squares.
 4. The system of claim 1, wherein the group workloadsbased on the workload attributes, the dependencies, and the utilizationperformance measurements into the affinity groups comprises utilizingk-means clustering to partition at least the utilization performancemeasurements and CPU utilization measurements into a number of sets soas to minimize a within-cluster sum of squares.
 5. The system of claim1, wherein the discover workload attributes and identify dependenciesamong compute, network, and storage elements of the enterprise systemincludes receiving on-premise network data from hardware probes withinthe enterprise system and determining source and destination of theon-premise network data.
 6. The system of claim 1, wherein workloadcharacteristics includes attributes of an entity associated with theworkload.
 7. The system of claim 1, wherein the executable instructionsthat are executable by the at least one processor to further: determinecloud virtual machines instance needs for each of the representativesynthetic workloads; identify cloud storage disk types for each of therepresentative synthetic workloads based on the storage devicesassociated with the respective representative synthetic workload; andfor each representative synthetic workload, determine periodic costassociated with the cloud virtual machine instances and the cloudstorage disk types, wherein the cloud workload cost is based, at leastin part, on the periodic cost.
 8. The system of claim 7, wherein the oneor more of the representative synthetic workloads is performed in the atleast one CSP's cloud services to assist in determining cloud virtualmachine instance needs.
 9. The system of claim 4, wherein the k-meansclustering includes given a set of utilization metrics measurements (x₁,x₂, . . . , x_(n)), where each utilization metrics measurement is ad-dimensional real vector, utilizing k-means clustering to partition nutilization metrics measurement into k(≤n) sets S={S₁, S₂, . . . ,S_(k)} so as to minimize a within-cluster sum of squares (WCSS).
 10. Acomputer readable medium including instructions, the instructions beingexecutable by a processor to perform a method, the method comprising:discovering a plurality of applications executing on an enterprisesystem based on network traffic; discovering workload attributes andidentify dependencies of the plurality of applications executing on theenterprise system, the workload attributes being among compute, network,and storage elements of the enterprise system, the enterprise systemincluding any number of networks, applications on servers, and storagedevices which are on-premise; receiving utilization performancemeasurements including memory utilization measurements of at least asubset of workloads, each workload including the workload attributes andidentified dependencies; grouping workloads based on the workloadattributes, the dependencies, and the utilization performancemeasurements into affinity groups; determining at least onerepresentative synthetic workload for each affinity group, eachrepresentative synthetic workload including a time slice of apredetermined period of time when there are maximum performance valuesfor any number of utilization performance measurements among virtualmachines of that particular affinity group; determining at least onecloud service provider (CSP)'s cloud services based on performance ofthe representative synthetic workloads; and generating a report for atleast one of the representative synthetic workloads, the reportidentifying the at least one of the representative synthetic workloadsand the at least one CSP's cloud services including cloud workload cost,the cloud workload cost being based on a periodic cost associated withexecuting the at least one of the representative synthetic workload onthe at least one CSP's cloud services.
 11. The method of claim 10,wherein the utilization performance measurements include CPU utilizationmeasurements.
 12. The method of claim 10, wherein grouping workloadsbased on the workload attributes, the dependencies, and the utilizationperformance measurements into the affinity groups comprises utilizingk-means clustering to partition at least the utilization performancemeasurements into a number of sets so as to minimize a within-clustersum of squares.
 13. The method of claim 10, wherein the groupingworkloads based on the workload attributes, the dependencies, and theutilization performance measurements into the affinity groups comprisesutilizing k-means clustering to partition at least the utilizationperformance measurements and CPU utilization measurements into a numberof sets so as to minimize a within-cluster sum of squares.
 14. Themethod of claim 10, wherein the discover workload attributes andidentify dependencies among compute, network, and storage elements ofthe enterprise system includes receiving on-premise network data fromhardware probes within the enterprise system and determining source anddestination of the on-premise network data.
 15. The method of claim 10,wherein workload characteristics includes attributes of an entityassociated with the workload.
 16. The method of claim 10, the methodfurther comprising: determine cloud virtual machines instance needs foreach of the representative synthetic workloads; identify cloud storagedisk types for each of the representative synthetic workloads based onthe storage devices associated with the respective representativesynthetic workload; and for each representative synthetic workload,determine periodic cost associated with the cloud virtual machineinstances and the cloud storage disk types, wherein the cloud workloadcost is based, at least in part, on the periodic cost.
 17. The method ofclaim 16, wherein the one or more of the representative syntheticworkloads is performed in the at least one CSP's cloud services toassist in determining cloud virtual machine instance needs.
 18. Themethod of claim 13, wherein the k-means clustering includes given a setof utilization metrics measurements (x₁, x₂, . . . , x_(n)), where eachutilization metrics measurement is a d-dimensional real vector,utilizing k-means clustering to partition n utilization metricsmeasurement into k(≤n) sets S={S₁, S₂, . . . , S_(k)} so as to minimizea within-cluster sum of squares (WCSS).
 19. A method comprising:discovering a plurality of applications executing on an enterprisesystem based on network traffic; discovering workload attributes andidentify dependencies of the plurality of applications executing on theenterprise system, the workload attributes being among compute, network,and storage elements of the enterprise system, the enterprise systemincluding any number of networks, applications on servers, and storagedevices which are on-premise; receiving utilization performancemeasurements including memory utilization measurements of at least asubset of workloads, each workload including the workload attributes andidentified dependencies; grouping workloads based on the workloadattributes, the dependencies, and the utilization performancemeasurements into affinity groups; determining at least onerepresentative synthetic workload for each affinity group, eachrepresentative synthetic workload including a time slice of apredetermined period of time when there are maximum performance valuesfor any number of utilization performance measurements among virtualmachines of that particular affinity group; determining at least onecloud service provider (CSP)'s cloud services based on performance ofthe representative synthetic workloads; and generating a report for atleast one of the representative synthetic workloads, the reportidentifying the at least one of the representative synthetic workloadsand the at least one CSP's cloud services including cloud workload cost,the cloud workload cost being based on a periodic cost associated withexecuting the at least one of the representative synthetic workload onthe at least one CSP's cloud services.